# Windows攻击机端 - Linux权限维持远程部署PowerShell脚本
# 使用方法: .\Deploy-LinuxPersistence.ps1 -TargetIP "192.168.1.100" -Username "root" -Password "password"
# 执行位置: Windows攻击机上执行

param(
    [Parameter(Mandatory=$true)]
    [string]$TargetIP,
    
    [Parameter(Mandatory=$true)]
    [string]$Username,
    
    [Parameter(Mandatory=$false)]
    [string]$Password,
    
    [Parameter(Mandatory=$false)]
    [string]$PrivateKeyPath,
    
    [Parameter(Mandatory=$false)]
    [switch]$Cleanup
)

# 颜色函数
function Write-ColorOutput {
    param(
        [string]$Message,
        [string]$Color = "White"
    )
    
    $colorMap = @{
        "Red" = "Red"
        "Green" = "Green"
        "Yellow" = "Yellow"
        "Blue" = "Cyan"
        "White" = "White"
    }
    
    Write-Host $Message -ForegroundColor $colorMap[$Color]
}

# 显示横幅
Write-ColorOutput "╔══════════════════════════════════════════════════════════════╗" "Blue"
Write-ColorOutput "║              Windows攻击机端 - 权限维持远程部署工具          ║" "Blue"
Write-ColorOutput "║              目标: $Username@$TargetIP                      ║" "Blue"
Write-ColorOutput "╚══════════════════════════════════════════════════════════════╝" "Blue"

# 检查必要工具
Write-ColorOutput "[1/5] 检查必要工具..." "Yellow"

# 检查SSH客户端
$sshPath = Get-Command ssh -ErrorAction SilentlyContinue
if (-not $sshPath) {
    Write-ColorOutput "✗ 未找到SSH客户端，请安装OpenSSH客户端" "Red"
    Write-ColorOutput "  可通过Windows功能或下载安装" "Yellow"
    exit 1
}

$scpPath = Get-Command scp -ErrorAction SilentlyContinue
if (-not $scpPath) {
    Write-ColorOutput "✗ 未找到SCP客户端" "Red"
    exit 1
}

Write-ColorOutput "✓ SSH/SCP工具检查通过" "Green"

# 检查连通性
Write-ColorOutput "[2/5] 检查目标连通性..." "Yellow"
$pingResult = Test-Connection -ComputerName $TargetIP -Count 1 -Quiet
if ($pingResult) {
    Write-ColorOutput "✓ 目标主机可达" "Green"
} else {
    Write-ColorOutput "✗ 目标主机不可达" "Red"
    exit 1
}

# 准备SSH连接参数
Write-ColorOutput "[3/5] 准备SSH连接..." "Yellow"
$sshOptions = "-o StrictHostKeyChecking=no -o UserKnownHostsFile=NUL"

if ($Password) {
    # 使用密码认证 - 需要交互式输入
    Write-ColorOutput "使用密码认证模式" "Blue"
    $sshCmd = "ssh $sshOptions"
    $scpCmd = "scp $sshOptions"
} elseif ($PrivateKeyPath) {
    # 使用私钥认证
    if (-not (Test-Path $PrivateKeyPath)) {
        Write-ColorOutput "✗ 私钥文件不存在: $PrivateKeyPath" "Red"
        exit 1
    }
    Write-ColorOutput "使用私钥认证模式" "Blue"
    $sshCmd = "ssh $sshOptions -i `"$PrivateKeyPath`""
    $scpCmd = "scp $sshOptions -i `"$PrivateKeyPath`""
} else {
    # 使用默认SSH配置
    Write-ColorOutput "使用默认SSH配置" "Blue"
    $sshCmd = "ssh $sshOptions"
    $scpCmd = "scp $sshOptions"
}

# 测试SSH连接
Write-ColorOutput "测试SSH连接..." "Blue"
$testCmd = "$sshCmd $Username@$TargetIP `"echo 'SSH连接测试成功'`""
try {
    $result = Invoke-Expression $testCmd 2>$null
    if ($result -match "SSH连接测试成功") {
        Write-ColorOutput "✓ SSH连接正常" "Green"
    } else {
        throw "连接失败"
    }
} catch {
    Write-ColorOutput "✗ SSH连接失败，请检查凭据和网络" "Red"
    Write-ColorOutput "  如使用密码认证，请确保目标支持密码登录" "Yellow"
    exit 1
}

# 上传测试脚本
Write-ColorOutput "[4/5] 上传测试脚本到目标机器..." "Yellow"
$scriptPath = Join-Path $PSScriptRoot "simple_test.sh"
if (-not (Test-Path $scriptPath)) {
    Write-ColorOutput "✗ 找不到simple_test.sh脚本在: $scriptPath" "Red"
    exit 1
}

$uploadCmd = "$scpCmd `"$scriptPath`" $Username@$TargetIP:/tmp/simple_test.sh"
try {
    Invoke-Expression $uploadCmd
    Write-ColorOutput "✓ 脚本上传成功" "Green"
} catch {
    Write-ColorOutput "✗ 脚本上传失败" "Red"
    exit 1
}

# 执行测试或清理
if ($Cleanup) {
    Write-ColorOutput "[5/5] 清理目标机器测试环境..." "Yellow"
    $cleanupCmd = "$sshCmd $Username@$TargetIP `"sudo bash /tmp/simple_test.sh cleanup`""
    try {
        Invoke-Expression $cleanupCmd
        Write-ColorOutput "✓ 目标机器清理完成" "Green"
    } catch {
        Write-ColorOutput "✗ 清理过程中出现错误" "Red"
    }
    
    # 删除上传的脚本
    $removeCmd = "$sshCmd $Username@$TargetIP `"rm -f /tmp/simple_test.sh`""
    Invoke-Expression $removeCmd 2>$null
    
} else {
    Write-ColorOutput "[5/5] 在目标机器上执行权限维持测试..." "Yellow"
    Write-ColorOutput "════════════════ 目标机器执行输出 ════════════════" "Blue"
    
    $testCmd = "$sshCmd $Username@$TargetIP `"sudo bash /tmp/simple_test.sh`""
    try {
        Invoke-Expression $testCmd
        Write-ColorOutput "════════════════ 执行完成 ════════════════" "Blue"
    } catch {
        Write-ColorOutput "✗ 测试执行过程中出现错误" "Red"
    }
    
    # 下载测试报告
    Write-ColorOutput "[下载] 获取测试报告..." "Yellow"
    $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
    $reportName = "test_report_${TargetIP}_${timestamp}.txt"
    
    $downloadCmd = "$scpCmd $Username@$TargetIP:/tmp/persistence_test_report_*.txt `"$reportName`""
    try {
        Invoke-Expression $downloadCmd 2>$null
        Write-ColorOutput "✓ 测试报告已下载: $reportName" "Green"
    } catch {
        Write-ColorOutput "⚠️  报告下载失败，请手动获取" "Yellow"
    }
}

Write-ColorOutput "`n🎉 操作完成！" "Green"

if (-not $Cleanup) {
    Write-ColorOutput "[提示] 要清理目标机器，请运行:" "Blue"
    Write-ColorOutput "       .\Deploy-LinuxPersistence.ps1 -TargetIP $TargetIP -Username $Username -Cleanup" "Blue"
    if ($Password) {
        Write-ColorOutput "       (添加 -Password 参数如果需要)" "Blue"
    }
    if ($PrivateKeyPath) {
        Write-ColorOutput "       (添加 -PrivateKeyPath 参数如果需要)" "Blue"
    }
}

# 使用示例
Write-ColorOutput "`n使用示例:" "Blue"
Write-ColorOutput "# 使用密码认证:" "Yellow"
Write-ColorOutput ".\Deploy-LinuxPersistence.ps1 -TargetIP `"192.168.1.100`" -Username `"root`" -Password `"password`"" "White"
Write-ColorOutput "`n# 使用私钥认证:" "Yellow"
Write-ColorOutput ".\Deploy-LinuxPersistence.ps1 -TargetIP `"192.168.1.100`" -Username `"ubuntu`" -PrivateKeyPath `"C:\path\to\private.key`"" "White"
Write-ColorOutput "`n# 清理环境:" "Yellow"
Write-ColorOutput ".\Deploy-LinuxPersistence.ps1 -TargetIP `"192.168.1.100`" -Username `"root`" -Cleanup" "White"